HackingProfessional ServicesProfessional ServicesStolen CredentialsEmail MisuseTargetedCustomer Data InvolvedPIIPCIFinancial accountFinancial credentialsLowActive

Securities Training Corporation

bd_c02f850f719b90c1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 28, 2019

Filed

Sep 13, 2019

To disclose

16 days

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for Securities Training Corporation →

Securities Training Corporation notified individuals of a data breach where an unauthorized third party may have accessed communications containing names and credit card details. Access likely occurred between April 16 and June 14, 2019. The company was made aware on August 28, 2019. No definitive evidence of access was found, but notification was sent as a precaution. Experian IdentityWorks was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 134 days

discovery → filing · 16 days

Apr 16, 2019

Begins

Aug 28, 2019

Discovered

Sep 13, 2019

Filed

vs. sector median

15 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a915399bc559d24f2019-09-13Verified
New Hampshire State AGbd_802c667e066a77412019-09-20 · +7dVerified

Name: Securities Training Corporation
norm: securities training
Domain: stcusa.com

Name: Securities Training Corporation
norm: securities training
Domain: stcusa.com
Industry: Professional Servicesllm

Discovered: Aug 28, 2019
Breach occurred: Apr 16, 2019 – Jun 14, 2019
Undetected for: 134 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIPCIFinancial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notifying applicable state regulators and consumer reporting agencies about this incident
Initial access: valid_credentials

During the incident: Implemented security measures designed to prevent unauthorized third parties from obtaining unauthorized access to our email and related systems
Providing written notice of this incident to those who may be impacted
Notifying applicable state regulators and consumer reporting agencies about this incident
Offering a complimentary one-year membership of Experian’s IdentityWorks
Changes made: Implemented security measures designed to prevent unauthorized third parties from obtaining unauthorized access to our email and related systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 13 · first

Montana State AGSep 13 · first · this page

New Hampshire State AG+7d

Pattern: first filing Sep 13 (MA), last Sep 20 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notice-23.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 13, 2019
Raw hash: e2c7d578ec961a46812d2a1f61fd2fb6cc6e88287fc019edbb746f5f13b4fa69

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySecurities Training Corporation

Victim entitySecurities Training Corporation

Incidentdiscovered Aug 28, 2019

Stated responseImplemented security measures designed to prevent unauthorized third parties from obtaining unauthorized access to our email and related systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov